landing: kGOA units, full money stats, rootless resource display

Public bank/exchange/merchant landing stats and performance UI only.
Secret goa-ui overlay stays on local/merchant-secret-ui (never push).

scripts/taler-landing/merge_resources.py

@@ -63,12 +63,46 @@ def merge(stats: Dict[str, Any], resources: Dict[str, Any]) -> Dict[str, Any]:
 
     if resources.get("loadavg"):
         perf["loadavg"] = resources["loadavg"]
-        perf["loadavg_source"] = "container"
+        # rootless: /proc/loadavg is almost always the host's
+        perf["loadavg_source"] = resources.get("loadavg_source") or "host_via_container_proc"
+        if resources.get("loadavg_note"):
+            perf["loadavg_note"] = resources["loadavg_note"]
+
+    if resources.get("cpu_percent") is not None:
+        perf["cpu_percent"] = resources["cpu_percent"]
+        perf["cpu_percent_label"] = resources.get("cpu_percent_label") or (
+            f'{resources["cpu_percent"]:.2f}%'
+        )
+
+    if resources.get("pids") is not None:
+        perf["pids"] = resources["pids"]
 
     mem = resources.get("memory")
     if isinstance(mem, dict) and mem:
-        perf["memory"] = compact_memory(dict(mem))
-        perf["memory"]["source"] = resources.get("source") or "mem-snapshot"
+        m = compact_memory(dict(mem))
+        # normalize empty groups for UI
+        for key in ("taler", "java", "nginx", "postgres", "redis", "other"):
+            try:
+                n = int(m.get(f"{key}_n") or 0)
+                b = int(m.get(f"{key}_rss_bytes") or 0)
+            except Exception:
+                n, b = 0, 0
+            if n <= 0 or b <= 0:
+                m[f"{key}_n"] = 0
+                m[f"{key}_rss_bytes"] = 0
+                m[f"{key}_rss_human"] = None
+        h = m.get("container_rss_human") or "—"
+        has_cgroup = bool(m.get("cgroup_bytes"))
+        if m.get("cgroup_limit_human") and h != "—":
+            m["container_rss_label"] = f"{h} / {m['cgroup_limit_human']}"
+            m["memory_basis"] = "cgroup"
+        elif not has_cgroup and h != "—":
+            m["container_rss_label"] = f"{h} (proc)"
+            m["memory_basis"] = m.get("memory_basis") or "proc_rss_sum"
+        elif not m.get("container_rss_label"):
+            m["container_rss_label"] = h
+        m["source"] = resources.get("source") or "mem-snapshot"
+        perf["memory"] = m
     return stats